Critical Linux TCP Flaw: Ubuntu and RHEL Still Await Kernel Fixes

Linux server owners have a critical kernel bug to deal with, and some of the most popular distributions do not have a fixed kernel ready yet. This piece is for system administrators, hosting providers, startups running cloud servers and IT teams who look after Linux machines exposed to the internet.

Key takeaways

• CVE-2026-98432 is a use-after-free flaw in how the Linux kernel handles IPv4 TCP connection requests. The kernel’s CVE team scores it 9.8 out of 10.
• Debian, Oracle Linux, parts of Amazon Linux and many SUSE releases have fixed kernels. Ubuntu’s supported releases and Red Hat Enterprise Linux 8, 9 and 10 were still waiting for fixes on 30 October.
• No vendor reports attacks in the wild, and the flaw was not in CISA’s Known Exploited Vulnerabilities catalog as of 29 October.
• Patch wherever a fixed kernel exists, and get ready to reboot quickly on Ubuntu and RHEL when updates land.

What happened

The Linux kernel CVE team published CVE-2026-98432 on 15 October 2026 and added a CVSS 3.1 score of 9.8 (Critical) on 24 October. The bug is a race condition in the IPv4 TCP handshake. When a new connection completes, the kernel hands the pending request’s IP options to the new socket without making its own copy. If the server is answering a retransmitted connection request at the same moment, those options can be used after the memory holding them has been freed. A second, similar race affects the migration of pending connection requests between sockets.

The faulty code dates back to Linux 4.4, so a very wide range of kernels is affected. The upstream fix defers freeing the options until it is safe to do so, and it has been included in the mainline kernel.

Why this one is getting attention

Anthropic says it found the flaw with an unreleased internal AI research model, and that the model produced a working exploit that could give a remote attacker root access to Linux servers running a Multipath TCP (MPTCP) listener, with no login or user interaction. Those exploit claims have not been independently verified, and no public exploit code has been linked from vendor advisories.

Vendors also disagree on severity. Ubuntu lists the 9.8 score and gives the issue High priority. Red Hat’s preliminary score is 8.1, and its description says the most likely result is a crash or possible memory corruption. Either way, it is a remotely reachable kernel bug in the core networking code, which is reason enough to act.

Who is affected and where the fixes stand

Patch status varies by distribution. As reported by vendors on 29 and 30 October:

• Debian 12 and 13: fixed through Debian’s security updates.
• Oracle Linux 7 to 10 (UEK kernels): fixed.
• Amazon Linux 2023: fixed for the kernel6.12 and kernel6.18 packages; the default kernel and Amazon Linux 2 were still pending.
• SUSE: SLES 16.0 and several SLES 15 service packs are fixed; SLES 15 SP7 was in progress and SUSE Linux Micro 6.0 and 6.1 had no fix yet.
• Ubuntu 22.04, 24.04, 26.04 and 26.10: listed as vulnerable with kernel updates in progress, including the cloud kernels for AWS, Azure, Google Cloud and Oracle.
• Ubuntu 16.04, 18.04 and 20.04: listed as vulnerable with no update in progress yet. Ubuntu 14.04 is not affected.
• Red Hat Enterprise Linux 8, 9 and 10 and OpenShift: affected, with no fix date announced. RHEL 7 is listed as not affected.

Ubuntu is a common choice for virtual private servers and cloud instances used by startups, agencies and hosting companies across Nigeria and the rest of Africa, so many small teams will be in the “waiting” group.

Is MPTCP the only risk?

Not necessarily. MPTCP is switched off unless an application asks for it, and Anthropic’s exploit reportedly targeted MPTCP listeners. However, neither the CVE record nor the kernel fix mentions MPTCP, and no vendor has said that servers without it are safe. One detail matters for developers: programs built with Go 1.24 or later use MPTCP by default for listening sockets on Linux where the kernel supports it.

Is there a workaround?

Red Hat says no mitigation is available that meets its criteria, and Ubuntu’s page does not describe a workaround. The request-migration variant of the bug needs the net.ipv4.tcp_migrate_req setting to be turned on, or a special reuseport eBPF program to be loaded. That setting is off by default, but it is worth confirming. Researchers have also suggested filtering unusual IPv4 options at the network edge, but no vendor has confirmed that this blocks the flaw, so treat it as an extra layer at best, not a fix.

What you should do

1. List your Linux servers. Note the distribution, release and kernel version of every internet-facing machine, including cloud instances and containers’ host nodes.
2. Patch where you can today. On Debian, Oracle Linux, SUSE and fixed Amazon Linux kernels, install the updated kernel and reboot, or confirm that your live-patching service covers this CVE. A kernel update does nothing until the new kernel is running.
3. Prepare Ubuntu and RHEL machines. Check the Ubuntu and Red Hat CVE pages daily, pre-approve a maintenance window and have reboot plans ready so you can move the same day fixes appear.
4. Check settings. Run sysctl net.ipv4.tcp_migrate_req and make sure it returns 0 unless you have a specific reason to use it.
5. Review MPTCP use. Find services that use MPTCP, including Go 1.24+ applications, and turn it off where you do not need it, while remembering that no vendor says this removes the risk.
6. Reduce exposure. Keep only necessary ports open to the internet and put management services behind a VPN or firewall allow-list.
7. Watch your logs. Investigate unexpected kernel crashes on exposed servers. A quiet log is not proof of safety, but a crash pattern deserves attention.
8. Upgrade old releases. If you still run Ubuntu 16.04, 18.04 or 20.04 without extended support, plan a move to a supported release now; this flaw shows why.

We will keep watching the Ubuntu and Red Hat advisories. Until fixed kernels arrive, the best defence is a clear inventory and a reboot plan ready to go.

Sources

• Ubuntu: CVE-2026-98432
• Red Hat: CVE-2026-98432
• Rescana: Linux Kernel CVE-2026-98432 analysis
• FourWeekMBA: Red Hat, Ubuntu lack fix for Linux flaw

Featured image: Photo: "Server rack" by towo™, CC BY-SA 2.0, via Openverse — source